CVE-2026-99015

Bluetooth: hci_sock: Serialize dead-device detachment

Published Oct 23, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sock: Serialize dead-device detachment

Rebinding an HCI socket after its controller is unregistered can race
monitor control replay and crash the kernel. hci_sock_bind() clears
hci_pi(sk)->hdev and drops the device reference under only the socket
lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for
reading.

Replay can observe a non-NULL hdev, then bind can clear it and drop the
last reference before create_monitor_ctrl_open() reads hdev->id. This
can cause a NULL pointer dereference if the pointer is reloaded, or a
use-after-free if the old pointer is retained.

The kernel reported:

KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
RIP: 0010:create_monitor_ctrl_open+0x579/0x800
Call Trace:
hci_sock_bind+0xd96/0x1190
__sys_bind+0x166/0x200
__x64_sys_bind+0x6d/0xb0
do_syscall_64+0xdd/0x4a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The same missing serialization lets hci_send_to_sock() select a socket
for the old device and queue its frame after bind has detached the socket
or installed a new binding.

Take hci_sk_list.lock for writing when clearing the device pointer and
resetting the socket state. This waits for existing replay and delivery
readers to finish before detachment and prevents later readers from
using the old binding. Keep hci_dev_put() outside the critical section
because the final device release can sleep.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1`	affected	< 88f47e66b1a6e0bfc350676937f3b552b434e74c
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 304adbdb96b0491c2b377e216b0bf417fc8e69a9
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 362126f739889436048f5573ebc87466d2525fd9
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 37cef0c8fb537f40600910d2c2e5f2d5509305f3
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 76f2e2665697340ac719e7ff1bf148dd014e55c1
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< c3d2799877906d0c8392d96e14216cd82b020330
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< e660a22402944f2615a16fde7129a3c497537329
`e04480920d1eec9c061841399aa6f35b6f987d8b`	affected	< 381a0925c556a8d91a80a9b9e3e86651d60ffee3
`d6ef8bb00aa65eceb413fc165a55086459863e38`	affected	—
`0e77f979a97d3d517fad0b51249ba6fb8ae2d365`	affected	—
`0782c8c7f80c9dd457acdfe16fd0f339f0e73093`	affected	—
`3719acc161d5c1ce09912cc1c9eddc2c5faa3c66`	affected	—
`ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35`	affected	—
`75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c`	affected	—
`5.10.58`	affected	< 5.10.273
`4.4.281`	affected	< 4.5
`4.9.280`	affected	< 4.10
`4.14.244`	affected	< 4.15
`4.19.203`	affected	< 4.20
`5.4.140`	affected	< 5.5
`5.13.10`	affected	< 5.14

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[e04480920d1eec9c061841399aa6f35b6f987d8b,37cef0c8fb537f40600910d2c2e5f2d5509305f3)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,76f2e2665697340ac719e7ff1bf148dd014e55c1)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,c3d2799877906d0c8392d96e14216cd82b020330)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,e660a22402944f2615a16fde7129a3c497537329)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,381a0925c556a8d91a80a9b9e3e86651d60ffee3)`	affected	code_commit	—
`[d6ef8bb00aa65eceb413fc165a55086459863e38,)`	affected	code_commit	—
`[0e77f979a97d3d517fad0b51249ba6fb8ae2d365,)`	affected	code_commit	—
`[0782c8c7f80c9dd457acdfe16fd0f339f0e73093,)`	affected	code_commit	—
`[3719acc161d5c1ce09912cc1c9eddc2c5faa3c66,)`	affected	code_commit	—
`[ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35,)`	affected	code_commit	—
`[f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1,)`	affected	code_commit	—
`[75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c,)`	affected	code_commit	—
`[4.4.281,4.5)`	affected	generic	—
`[4.9.280,4.10)`	affected	generic	—
`[4.14.244,4.15)`	affected	generic	—
`[4.19.203,4.20)`	affected	generic	—
`[5.4.140,5.5)`	affected	generic	—
`[5.10.58,5.11)`	affected	generic	—
`[5.13.10,5.14)`	affected	generic	—

Linux

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e04480920d1eec9c061841399aa6f35b6f987d8b,37cef0c8fb537f40600910d2c2e5f2d5509305f3)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,76f2e2665697340ac719e7ff1bf148dd014e55c1)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,c3d2799877906d0c8392d96e14216cd82b020330)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,e660a22402944f2615a16fde7129a3c497537329)`	affected	code_commit	—
`[e04480920d1eec9c061841399aa6f35b6f987d8b,381a0925c556a8d91a80a9b9e3e86651d60ffee3)`	affected	code_commit	—
`[d6ef8bb00aa65eceb413fc165a55086459863e38,)`	affected	code_commit	—
`[0e77f979a97d3d517fad0b51249ba6fb8ae2d365,)`	affected	code_commit	—
`[0782c8c7f80c9dd457acdfe16fd0f339f0e73093,)`	affected	code_commit	—
`[3719acc161d5c1ce09912cc1c9eddc2c5faa3c66,)`	affected	code_commit	—
`[ff29fe26ab8679bc13a3f0bf5b2911535a1cfc35,)`	affected	code_commit	—
`[f2f856b65ac4b77049c76c0e89ecd3a177e9fcd1,)`	affected	code_commit	—
`[75dd00b755ebfa9b24eaedc9f42e9adfc00ae00c,)`	affected	code_commit	—
`[4.4.281,4.5)`	affected	generic	—
`[4.9.280,4.10)`	affected	generic	—
`[4.14.244,4.15)`	affected	generic	—
`[4.19.203,4.20)`	affected	generic	—
`[5.4.140,5.5)`	affected	generic	—
`[5.10.58,5.11)`	affected	generic	—
`[5.13.10,5.14)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.57,6.18.*]`	unaffected	generic	—
`[7.2.11,7.2.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—
`[7.3,7.*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99015.mbox
https://git.kernel.org/stable/c/304adbdb96b0491c2b377e216b0bf417fc8e69a9
https://git.kernel.org/stable/c/362126f739889436048f5573ebc87466d2525fd9
https://git.kernel.org/stable/c/37cef0c8fb537f40600910d2c2e5f2d5509305f3
https://git.kernel.org/stable/c/381a0925c556a8d91a80a9b9e3e86651d60ffee3
https://git.kernel.org/stable/c/76f2e2665697340ac719e7ff1bf148dd014e55c1
https://git.kernel.org/stable/c/88f47e66b1a6e0bfc350676937f3b552b434e74c
https://git.kernel.org/stable/c/c3d2799877906d0c8392d96e14216cd82b020330
https://git.kernel.org/stable/c/e660a22402944f2615a16fde7129a3c497537329
https://nvd.nist.gov/vuln/detail/CVE-2026-99015
https://www.cve.org/CVERecord?id=CVE-2026-99015

History

Oct 30, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/304adbdb96b0491c2b377e216b0bf417fc8e69a9 https://git.kernel.org/stable/c/362126f739889436048f5573ebc87466d2525fd9 https://git.kernel.org/stable/c/88f47e66b1a6e0bfc350676937f3b552b434e74c

Oct 29, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99015.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99015 https://www.cve.org/CVERecord?id=CVE-2026-99015
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 23, 2026 7:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 3:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416 CWE-476

Oct 23, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci_sock_bind() clears hci_pi(sk)->hdev and drops the device reference under only the socket lock, whereas send_monitor_control_replay() holds hci_sk_list.lock for reading. Replay can observe a non-NULL hdev, then bind can clear it and drop the last reference before create_monitor_ctrl_open() reads hdev->id. This can cause a NULL pointer dereference if the pointer is reloaded, or a use-after-free if the old pointer is retained. The kernel reported: KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] RIP: 0010:create_monitor_ctrl_open+0x579/0x800 Call Trace: hci_sock_bind+0xd96/0x1190 __sys_bind+0x166/0x200 __x64_sys_bind+0x6d/0xb0 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The same missing serialization lets hci_send_to_sock() select a socket for the old device and queue its frame after bind has detached the socket or installed a new binding. Take hci_sk_list.lock for writing when clearing the device pointer and resetting the socket state. This waits for existing replay and delivery readers to finish before detachment and prevents later readers from using the old binding. Keep hci_dev_put() outside the critical section because the final device release can sleep.
Title		Bluetooth: hci_sock: Serialize dead-device detachment
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37cef0c8fb537f40600910d2c2e5f2d5509305f3 https://git.kernel.org/stable/c/381a0925c556a8d91a80a9b9e3e86651d60ffee3 https://git.kernel.org/stable/c/76f2e2665697340ac719e7ff1bf148dd014e55c1 https://git.kernel.org/stable/c/c3d2799877906d0c8392d96e14216cd82b020330 https://git.kernel.org/stable/c/e660a22402944f2615a16fde7129a3c497537329